Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

All Questions

Tagged with
0
votes
1answer
88 views

What is Passive DNS Replication?

I use Virus Total for Malware Research, and I saw that it has a field called: "Passive DNS Replication", but I do not exactly understand what that means.I searched in VT blog, and they said that it is ...
0
votes
1answer
92 views

Unexplained DNS connections on boot

I was on an Ubuntu VPS today, with a bind9 DNS server (without DNSSEC configured) installed and running. Immediately after booting the machine I ran: netstat -tanp And received this output: Proto ...
0
votes
1answer
505 views

Check router for DNS changer virus

I want to verify that router was not affected by DNS changer virus. Router provided by local Internet provider, runs custom firmware with web admin which does not contain DNS settings, no telnet/ssh/...
6
votes
2answers
1k views

Why is my Windows desktop using a DNS Server on localhost?

I recently inherited a corporate network and one of the devices kept having errors connecting to mapped network drives with errors pertaining to the server time being different than the computer's ...
1
vote
1answer
68 views

Is OSX/MaMi a real malware or a simple filtering software?

Recently a lot of communications spread starting from this analysis: OSX/MaMi analysis When I read this analysis, I found that 2 DNS servers are defined as default ones for the IP configuration: 82....
1
vote
1answer
601 views

Will changing the Wifi router fix a hijacked Wifi problem? [closed]

The other day, I was browsing casually through the web with my laptop. I visited a site that somehow managed to open a popup ad under my notice. This popup ad site I think has malware written all ...
0
votes
1answer
139 views

Why don't more DGA malware families use word-lists?

Of all the known malware families that use DGAs to communicate with their C2, only very few use DGAs that generate non-random-looking domain names. For example, Suppobox generates domain names by ...
4
votes
3answers
2k views

How does Malware use Unregistered Domains

I just finished reading that the WannaDecryptor malware was querying an unregistered domain. I thought it was connecting to its command and control server. Is this correct? It is my understanding ...
1
vote
0answers
46 views

Forwarding requests to known suspicious site to an isolated server

I keep getting IPS alerts for suspicious DNS requests for a known host with malware. I can't find anything from the Windows DNS logs from the domain controllers because it just shows the source ...
1
vote
1answer
35 views

MX records being linked to spamming?

I have seen a rule in an environment that detects DNS MX query types going from an internal source to an external, none SMTP server. The justification states that this could be indicative of malware ...
5
votes
1answer
713 views

Is this the end of malware use of DNS?

I read about the release of a free dataset of malware related DNS queries called "Predict". A researcher or network security team can download or query this data set and use it to identify malware ...
1
vote
2answers
2k views

Google DNS in Firewall logs

I was viewing my firewall logs and come across the IP 8.8.8.8. Further check reveals it belongs to Google DNS. And such traffic has been going out from some of our LAN segment PCs. From here on, how ...
2
votes
2answers
749 views

Roommate Frequently Hacked — How Do I Protect My Network/Devices?

If you absolutely had to share a network with a user who had a very lax approach to security and was frequently hacked (1-2x month for over a year now), what might you consider doing to secure your ...
6
votes
1answer
4k views

ISP glitch or a malware? Has this ever happened to you?

Brief background: I consider myself a relatively paranoid power-user, if not an absolute pro. I regularly update my AV and keep up with all the latest updates on my Windows 7 machine. But what ...
5
votes
2answers
5k views

How Do I Troubleshoot a Browser Hijack on a Mac?

My Mac is getting weird redirects with Safari and Chrome, however not with Mozilla Firefox. Since I cannot find software to do malware removal on Apple products or any good information, I am at a loss ...
2
votes
1answer
170 views

How did DNSChanger rogue name servers work?

I know DNS changer, changes DNS server with its own Evil DNS server on an infected computer, then the DNS servers point to their own rogue nameservers and the nameservers change the ads on websites ...
4
votes
2answers
1k views

How does DNS Changer malware detection work?

This malware directs your computer to use DNS servers under control of the badguys. These DNS servers were taken over by the FBI. They were replaced with clean ones, to prevent service disruption, but ...
1
vote
1answer
873 views

DNS query through squid? [closed]

My IDS picked up our squid proxy server doing a dynamic DNS request. I wasn't aware squid passed DNS requests from the client to the internal DNS server. Is this possible? Snort Alert: ET POLICY ...
1
vote
3answers
2k views

DNS queries with hex string that is a SHA1 of a domain name! Is it a malware?

My computer does a lot of queries to strange domains such as: 56cea5c2b408989ab067adcb787d0f99209bbe07.mydomain.com The strange thing is that 56cea5c2b408989ab067adcb787d0f99209bbe07 is the SHA1 of ...